# -*- coding: utf-8 -*-

"""

    rhodecode.controllers.admin.users_groups

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    User Groups crud controller for pylons

    :created_on: Jan 25, 2011

    :author: marcink

    :copyright: (C) 2010-2012 Marcin Kuzminski <marcin@python-works.com>

    :license: GPLv3, see COPYING for more details.

"""

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

import traceback

import formencode

from formencode import htmlfill

from pylons import request, session, tmpl_context as c, url, config

from pylons.controllers.util import abort, redirect

from pylons.i18n.translation import _

from rhodecode.lib import helpers as h

from rhodecode.lib.exceptions import UserGroupsAssignedException

from rhodecode.lib.utils2 import safe_unicode, str2bool, safe_int

from rhodecode.lib.auth import LoginRequired, HasPermissionAllDecorator,\

from rhodecode.lib.base import BaseController, render

from rhodecode.model.scm import UserGroupList

from rhodecode.model.users_group import UserGroupModel

from rhodecode.model.repo import RepoModel

from rhodecode.model.db import User, UserGroup, UserGroupToPerm,\

    UserGroupRepoToPerm, UserGroupRepoGroupToPerm

from rhodecode.model.forms import UserGroupForm, UserGroupPermsForm,\

    CustomDefaultPermissionsForm

from rhodecode.model.meta import Session

from rhodecode.lib.utils import action_logger

from sqlalchemy.orm import joinedload

from webob.exc import HTTPInternalServerError

log = logging.getLogger(__name__)

class UsersGroupsController(BaseController):

    """REST Controller styled on the Atom Publishing Protocol"""

    # To properly map this controller, ensure your config/routing.py

    # file has a resource setup:

    #     map.resource('users_group', 'users_groups')

    @LoginRequired()

    def __before__(self):

        super(UsersGroupsController, self).__before__()

        c.available_permissions = config['available_permissions']

    def __load_data(self, user_group_id):

        ugroup_repo_perms = UserGroupRepoToPerm.query()\

            .options(joinedload(UserGroupRepoToPerm.permission))\

            .options(joinedload(UserGroupRepoToPerm.repository))\

            .filter(UserGroupRepoToPerm.users_group_id == user_group_id)\

            .all()

        for gr in ugroup_repo_perms:

            c.users_group.permissions['repositories'][gr.repository.repo_name]  \

                = gr.permission.permission_name

        ugroup_group_perms = UserGroupRepoGroupToPerm.query()\

            .options(joinedload(UserGroupRepoGroupToPerm.permission))\

            .options(joinedload(UserGroupRepoGroupToPerm.group))\

            .filter(UserGroupRepoGroupToPerm.users_group_id == user_group_id)\

            .all()

        for gr in ugroup_group_perms:

            c.users_group.permissions['repositories_groups'][gr.group.group_name] \

                = gr.permission.permission_name

        c.group_members_obj = sorted((x.user for x in c.users_group.members),

                                     key=lambda u: u.username.lower())

        c.group_members = [(x.user_id, x.username) for x in c.group_members_obj]

        c.available_members = sorted(((x.user_id, x.username) for x in

                                      User.query().all()),

                                     key=lambda u: u[1].lower())

        repo_model = RepoModel()

        c.users_array = repo_model.get_users_js()

        # commented out due to not now supporting assignment for user group

        # on user group

        c.users_groups_array = "[]"  # repo_model.get_users_groups_js()

        c.available_permissions = config['available_permissions']

    def __load_defaults(self, user_group_id):

        """

        Load defaults settings for edit, and update

        :param user_group_id:

        """

        user_group = UserGroup.get_or_404(user_group_id)

        data = user_group.get_dict()

        ug_model = UserGroupModel()

        data.update({

            'create_repo_perm': ug_model.has_perm(user_group,

                                                  'hg.create.repository'),

            'create_user_group_perm': ug_model.has_perm(user_group,

                                                  'hg.usergroup.create.true'),

            'fork_repo_perm': ug_model.has_perm(user_group,

                                                'hg.fork.repository'),

        })

        # fill user group users

        for p in user_group.user_user_group_to_perm:

            data.update({'u_perm_%s' % p.user.username:

                             p.permission.permission_name})

        return data

    def index(self, format='html'):

        """GET /users_groups: All items in the collection"""

        # url('users_groups')

        group_iter = UserGroupList(UserGroup().query().all(),

                                   perm_set=['usergroup.admin'])

        sk = lambda g: g.users_group_name

        c.users_groups_list = sorted(group_iter, key=sk)

        return render('admin/users_groups/users_groups.html')

    def create(self):

        """POST /users_groups: Create a new item"""

        # url('users_groups')

        users_group_form = UserGroupForm()()

        try:

            form_result = users_group_form.to_python(dict(request.POST))

            UserGroupModel().create(name=form_result['users_group_name'],

                                    owner=self.rhodecode_user.user_id,

                                    active=form_result['users_group_active'])

            gr = form_result['users_group_name']

            action_logger(self.rhodecode_user,

                          'admin_created_users_group:%s' % gr,

                          None, self.ip_addr, self.sa)

            h.flash(_('Created user group %s') % gr, category='success')

            Session().commit()

        except formencode.Invalid, errors:

            return htmlfill.render(

                render('admin/users_groups/users_group_add.html'),

                defaults=errors.value,

                errors=errors.error_dict or {},

                prefix_error=False,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('Error occurred during creation of user group %s') \

                    % request.POST.get('users_group_name'), category='error')

        return redirect(url('users_groups'))

    def new(self, format='html'):

        """GET /users_groups/new: Form to create a new item"""

        # url('new_users_group')

        return render('admin/users_groups/users_group_add.html')

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def update(self, id):

        """PUT /users_groups/id: Update an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="PUT" />

        # Or using helpers:

        #    h.form(url('users_group', id=ID),

        #           method='put')

        # url('users_group', id=ID)

        c.users_group = UserGroup.get_or_404(id)

        self.__load_data(id)

        available_members = [safe_unicode(x[0]) for x in c.available_members]

        users_group_form = UserGroupForm(edit=True,

                                          old_data=c.users_group.get_dict(),

                                          available_members=available_members)()

        try:

            form_result = users_group_form.to_python(request.POST)

            UserGroupModel().update(c.users_group, form_result)

            gr = form_result['users_group_name']

            action_logger(self.rhodecode_user,

                          'admin_updated_users_group:%s' % gr,

                          None, self.ip_addr, self.sa)

            h.flash(_('Updated user group %s') % gr, category='success')

            Session().commit()

        except formencode.Invalid, errors:

            ug_model = UserGroupModel()

            defaults = errors.value

            e = errors.error_dict or {}

            defaults.update({

                'create_repo_perm': ug_model.has_perm(id,

                                                      'hg.create.repository'),

                'fork_repo_perm': ug_model.has_perm(id,

                                                    'hg.fork.repository'),

                '_method': 'put'

            })

            return htmlfill.render(

                render('admin/users_groups/users_group_edit.html'),

                defaults=defaults,

                errors=e,

                prefix_error=False,

                encoding="UTF-8")

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('Error occurred during update of user group %s') \

                    % request.POST.get('users_group_name'), category='error')

        return redirect(url('edit_users_group', id=id))

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def delete(self, id):

        """DELETE /users_groups/id: Delete an existing item"""

        # Forms posted to this method should contain a hidden field:

        #    <input type="hidden" name="_method" value="DELETE" />

        # Or using helpers:

        #    h.form(url('users_group', id=ID),

        #           method='delete')

        # url('users_group', id=ID)

        usr_gr = UserGroup.get_or_404(id)

        try:

            UserGroupModel().delete(usr_gr)

            Session().commit()

            h.flash(_('Successfully deleted user group'), category='success')

        except UserGroupsAssignedException, e:

            h.flash(e, category='error')

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('An error occurred during deletion of user group'),

                    category='error')

        return redirect(url('users_groups'))

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def set_user_group_perm_member(self, id):

        """

        grant permission for given usergroup

        :param id:

        """

        user_group = UserGroup.get_or_404(id)

        form = UserGroupPermsForm()().to_python(request.POST)

        # set the permissions !

        UserGroupModel()._update_permissions(user_group, form['perms_new'],

                                            form['perms_updates'])

        #TODO: implement this

        #action_logger(self.rhodecode_user, 'admin_changed_repo_permissions',

        #              repo_name, self.ip_addr, self.sa)

        Session().commit()

        h.flash(_('User Group permissions updated'), category='success')

        return redirect(url('edit_users_group', id=id))

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def delete_user_group_perm_member(self, id):

        """

        DELETE an existing repository group permission user

        :param group_name:

        """

        try:

            obj_type = request.POST.get('obj_type')

            obj_id = None

            if obj_type == 'user':

                obj_id = safe_int(request.POST.get('user_id'))

            elif obj_type == 'user_group':

                obj_id = safe_int(request.POST.get('user_group_id'))

            if not c.rhodecode_user.is_admin:

                if obj_type == 'user' and c.rhodecode_user.user_id == obj_id:

                    msg = _('Cannot revoke permission for yourself as admin')

                    h.flash(msg, category='warning')

                    raise Exception('revoke admin permission on self')

            if obj_type == 'user':

                UserGroupModel().revoke_user_permission(user_group=id,

                                                        user=obj_id)

            elif obj_type == 'user_group':

                pass

            Session().commit()

        except Exception:

            log.error(traceback.format_exc())

            h.flash(_('An error occurred during revoking of permission'),

                    category='error')

            raise HTTPInternalServerError()

    def show(self, id, format='html'):

        """GET /users_groups/id: Show a specific item"""

        # url('users_group', id=ID)

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def edit(self, id, format='html'):

        """GET /users_groups/id/edit: Form to edit an existing item"""

        # url('edit_users_group', id=ID)

        c.users_group = UserGroup.get_or_404(id)

        self.__load_data(id)

        defaults = self.__load_defaults(id)

        return htmlfill.render(

            render('admin/users_groups/users_group_edit.html'),

            defaults=defaults,

            encoding="UTF-8",

            force_defaults=False

        )

    @HasUserGroupPermissionAnyDecorator('usergroup.admin')

    def update_perm(self, id):

        """PUT /users_perm/id: Update an existing item"""

        # url('users_group_perm', id=ID, method='put')

        users_group = UserGroup.get_or_404(id)

        try:

            form = CustomDefaultPermissionsForm()()

            form_result = form.to_python(request.POST)

            inherit_perms = form_result['inherit_default_permissions']

            users_group.inherit_default_permissions = inherit_perms

            Session().add(users_group)

            usergroup_model = UserGroupModel()

            defs = UserGroupToPerm.query()\

                .filter(UserGroupToPerm.users_group == users_group)\

                .all()

            for ug in defs:

                Session().delete(ug)

            if form_result['create_repo_perm']:

                usergroup_model.grant_perm(id, 'hg.create.repository')

            else:

                usergroup_model.grant_perm(id, 'hg.create.none')

            if form_result['create_user_group_perm']:

                usergroup_model.grant_perm(id, 'hg.usergroup.create.true')

            else:

                usergroup_model.grant_perm(id, 'hg.usergroup.create.false')

            if form_result['fork_repo_perm']:

                usergroup_model.grant_perm(id, 'hg.fork.repository')

            else:

                usergroup_model.grant_perm(id, 'hg.fork.none')

            h.flash(_("Updated permissions"), category='success')

            Session().commit()

        except Exception:

            log.error(traceback.format_exc())

# -*- coding: utf-8 -*-

"""

    rhodecode.model.users_group

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~

    user group model for RhodeCode

    :created_on: Oct 1, 2011

    :author: nvinot

    :copyright: (C) 2011-2011 Nicolas Vinot <aeris@imirhil.fr>

    :copyright: (C) 2010-2012 Marcin Kuzminski <marcin@python-works.com>

    :license: GPLv3, see COPYING for more details.

"""

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program.  If not, see <http://www.gnu.org/licenses/>.

import logging

import traceback

from rhodecode.model import BaseModel

from rhodecode.model.db import UserGroupMember, UserGroup,\

    UserGroupRepoToPerm, Permission, UserGroupToPerm, User, UserUserGroupToPerm

from rhodecode.lib.exceptions import UserGroupsAssignedException

log = logging.getLogger(__name__)

class UserGroupModel(BaseModel):

    cls = UserGroup

    def _get_user_group(self, users_group):

        return self._get_instance(UserGroup, users_group,

                                  callback=UserGroup.get_by_group_name)

    def _create_default_perms(self, user_group):

        # create default permission

        default_perm = 'usergroup.read'

        def_user = User.get_default_user()

        for p in def_user.user_perms:

            if p.permission.permission_name.startswith('usergroup.'):

                default_perm = p.permission.permission_name

                break

        user_group_to_perm = UserUserGroupToPerm()

        user_group_to_perm.permission = Permission.get_by_key(default_perm)

        user_group_to_perm.user_group = user_group

        user_group_to_perm.user_id = def_user.user_id

        return user_group_to_perm

    def _update_permissions(self, user_group, perms_new=None,

                            perms_updates=None):

        if not perms_new:

            perms_new = []

        if not perms_updates:

            perms_updates = []

        # update permissions

        for member, perm, member_type in perms_updates:

            if member_type == 'user':

                # this updates existing one

                self.grant_user_permission(

                    user_group=user_group, user=member, perm=perm

                )

            else:

                self.grant_users_group_permission(

                    user_group=user_group, group_name=member, perm=perm

                )

        # set new permissions

        for member, perm, member_type in perms_new:

            if member_type == 'user':

                self.grant_user_permission(

                    user_group=user_group, user=member, perm=perm

                )

            else:

                self.grant_users_group_permission(

                    user_group=user_group, group_name=member, perm=perm

                )

    def get(self, users_group_id, cache=False):

        return UserGroup.get(users_group_id)

    def get_group(self, users_group):

        return self._get_user_group(users_group)

    def get_by_name(self, name, cache=False, case_insensitive=False):

        return UserGroup.get_by_group_name(name, cache, case_insensitive)

    def create(self, name, owner, active=True):

        try:

            new_user_group = UserGroup()

            new_user_group.user = self._get_user(owner)

            new_user_group.users_group_name = name

            new_user_group.users_group_active = active

            self.sa.add(new_user_group)

            perm_obj = self._create_default_perms(new_user_group)

            self.sa.add(perm_obj)

            return new_user_group

        except Exception:

            log.error(traceback.format_exc())

            raise

    def update(self, users_group, form_data):

        try:

            users_group = self._get_user_group(users_group)

            for k, v in form_data.items():

                if k == 'users_group_members':

                    users_group.members = []

                    self.sa.flush()

                    members_list = []

                    if v:

                        v = [v] if isinstance(v, basestring) else v

                        for u_id in set(v):

                            member = UserGroupMember(users_group.users_group_id, u_id)

                            members_list.append(member)

                    setattr(users_group, 'members', members_list)

                setattr(users_group, k, v)

            self.sa.add(users_group)

        except Exception:

            log.error(traceback.format_exc())

            raise

    def delete(self, users_group, force=False):

        """

        Deletes repository group, unless force flag is used

        raises exception if there are members in that group, else deletes

        group and users

        :param users_group:

        :param force:

        """

        try:

            users_group = self._get_user_group(users_group)

            # check if this group is not assigned to repo

            assigned_groups = UserGroupRepoToPerm.query()\

                .filter(UserGroupRepoToPerm.users_group == users_group).all()

            if assigned_groups and not force:

                raise UserGroupsAssignedException('RepoGroup assigned to %s' %

                                                   assigned_groups)

            self.sa.delete(users_group)

        except Exception:

            log.error(traceback.format_exc())

            raise

    def add_user_to_group(self, users_group, user):

        users_group = self._get_user_group(users_group)

        user = self._get_user(user)

        for m in users_group.members:

            u = m.user

            if u.user_id == user.user_id:

                return True

        try:

            users_group_member = UserGroupMember()

            users_group_member.user = user

            users_group_member.users_group = users_group

            users_group.members.append(users_group_member)

            user.group_member.append(users_group_member)

            self.sa.add(users_group_member)

            return users_group_member

        except Exception:

            log.error(traceback.format_exc())

            raise

    def remove_user_from_group(self, users_group, user):

        users_group = self._get_user_group(users_group)

        user = self._get_user(user)

        users_group_member = None

        for m in users_group.members:

            if m.user.user_id == user.user_id:

                # Found this user's membership row

                users_group_member = m

                break

        if users_group_member:

            try:

                self.sa.delete(users_group_member)

                return True

            except Exception:

                log.error(traceback.format_exc())

                raise

        else:

            # User isn't in that group

            return False

    def has_perm(self, users_group, perm):

        users_group = self._get_user_group(users_group)

        perm = self._get_perm(perm)

        return UserGroupToPerm.query()\

            .filter(UserGroupToPerm.users_group == users_group)\

            .filter(UserGroupToPerm.permission == perm).scalar() is not None

    def grant_perm(self, users_group, perm):

        users_group = self._get_user_group(users_group)

        perm = self._get_perm(perm)

        # if this permission is already granted skip it

        _perm = UserGroupToPerm.query()\

            .filter(UserGroupToPerm.users_group == users_group)\

            .filter(UserGroupToPerm.permission == perm)\

            .scalar()

        if _perm:

            return

        new = UserGroupToPerm()

        new.users_group = users_group

        new.permission = perm

        self.sa.add(new)

    def revoke_perm(self, users_group, perm):

        users_group = self._get_user_group(users_group)

        perm = self._get_perm(perm)

        obj = UserGroupToPerm.query()\

            .filter(UserGroupToPerm.users_group == users_group)\

            .filter(UserGroupToPerm.permission == perm).scalar()

        if obj:

            self.sa.delete(obj)

    def grant_user_permission(self, user_group, user, perm):

        """

        Grant permission for user on given user group, or update

        existing one if found

        :param user_group: Instance of UserGroup, users_group_id,

            or users_group_name

        :param user: Instance of User, user_id or username

        :param perm: Instance of Permission, or permission_name

        """

        user_group = self._get_user_group(user_group)

        user = self._get_user(user)

        permission = self._get_perm(perm)

        # check if we have that permission already

        obj = self.sa.query(UserUserGroupToPerm)\

            .filter(UserUserGroupToPerm.user == user)\

            .filter(UserUserGroupToPerm.user_group == user_group)\

            .scalar()

        if obj is None:

            # create new !

            obj = UserUserGroupToPerm()

        obj.user_group = user_group

        obj.user = user

        obj.permission = permission

        self.sa.add(obj)

        log.debug('Granted perm %s to %s on %s' % (perm, user, user_group))

    def revoke_user_permission(self, user_group, user):

        """

        Revoke permission for user on given repository group

        :param user_group: Instance of ReposGroup, repositories_group_id,

            or repositories_group name

        :param user: Instance of User, user_id or username

        """

        user_group = self._get_user_group(user_group)

        user = self._get_user(user)

        obj = self.sa.query(UserUserGroupToPerm)\

            .filter(UserUserGroupToPerm.user == user)\

            .filter(UserUserGroupToPerm.user_group == user_group)\

            .scalar()

        if obj:

            self.sa.delete(obj)

            log.debug('Revoked perm on %s on %s' % (user_group, user))

    def grant_users_group_permission(self, user_group, group_name, perm):

        raise NotImplementedError()

    def revoke_users_group_permission(self, user_group, group_name):

        raise NotImplementedError()

## -*- coding: utf-8 -*-

<%inherit file="/base/base.html"/>

<%def name="title()">

    ${_('User groups administration')} · ${c.rhodecode_name}

</%def>

<%def name="breadcrumbs_links()">

    ${h.link_to(_('Admin'),h.url('admin_home'))}

    »

    ${_('User groups')}

</%def>

<%def name="page_nav()">

    ${self.menu('admin')}

</%def>

<%def name="main()">

<div class="box">

    <!-- box / title -->

    <div class="title">

        ${self.breadcrumbs()}

        <ul class="links">

          <li>

            <span>${h.link_to(_(u'Add new user group'),h.url('new_users_group'))}</span>

          </li>

        </ul>

    </div>

    <!-- end box / title -->

    <div class="table">

    %if c.users_groups_list:

        <table class="table_disp">

        <tr class="header">

            <th class="left">${_('Group name')}</th>

            <th class="left">${_('Members')}</th>

            <th class="left">${_('Active')}</th>

            <th class="left" colspan="2">${_('Action')}</th>

        </tr>

            %for cnt,u_group in enumerate(c.users_groups_list):

                <tr class="parity${cnt%2}">

                    <td>${h.link_to(u_group.users_group_name,h.url('edit_users_group', id=u_group.users_group_id))}</td>

                    <td><span class="tooltip" title="${h.tooltip(', '.join(map(h.safe_unicode,[x.user.username for x in u_group.members[:50]])))}">${len(u_group.members)}</span></td>

                    <td>${h.boolicon(u_group.users_group_active)}</td>

                    <td>

                     <a href="${h.url('edit_users_group', id=u_group.users_group_id)}" title="${_('Edit')}">

                       ${h.submit('edit_%s' % u_group.users_group_name,_('edit'),class_="edit_icon action_button")}

                     </a>

                    </td>

                    <td>

                        ${h.form(url('users_group', id=u_group.users_group_id),method='delete')}

                            ${h.submit('remove_',_('delete'),id="remove_group_%s" % u_group.users_group_id,

                            class_="delete_icon action_button",onclick="return  confirm('"+_('Confirm to delete this user group: %s') % u_group.users_group_name+"');")}

                        ${h.end_form()}

                    </td>

                </tr>

            %endfor

        </table>

    %else:

        ${_('There are no user groups yet')}

    %endif

    </div>

</div>

</%def>